Updated November 2026 · Southern New Hampshire
Certificate of destruction: what it must show and how long to keep it
A plain-English guide to the one document that proves your records were destroyed: the details a good certificate should carry, the red flags in a weak one, and the retention periods that decide how long it stays in your files.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- Every job certificate included
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
A certificate of destruction is the shredding company’s written record that your material was destroyed. A useful one names the company and the customer, gives the date of destruction, describes what was destroyed and how much, states the method, and carries a signature. Keep it at least as long as the rules behind the records require: six years for HIPAA documentation under 45 CFR 164.530(j)(2), and at least as long as the IRS period for tax records. New Hampshire Document Shredding includes a certificate with every document shredding job, covered by the $14.95 HIPAA filing fee.
What a certificate of destruction is, and what it is not
When you hand records to a shredding company, they leave your control. The certificate is the paper that closes that loop. It is the company’s signed statement that the material you gave it was destroyed, and it is what you show anyone who later asks where those records went.
It is not a receipt. A receipt proves you paid for a service. A certificate records a specific event: these materials, from this customer, destroyed on this date, by this method. If a patient, a client, an auditor or an insurer asks about a box of files from 2019, the receipt says you bought shredding. The certificate says the 2019 files are gone.
It is also not a guarantee of anything beyond what it describes. A certificate is only as good as the process behind it, which is why the chain of custody and the company’s habits matter as much as the paper itself.
For the full path your boxes take before the certificate is issued, read our post on chain of custody shredding. This post stays on the document itself.
What a certificate of destruction must contain
No federal rule prints a required template, so certificates vary from company to company. What matters is whether the document would answer the questions someone will ask years later. Use this checklist when you read any certificate, ours included.
| Item | What to look for | Why it matters |
|---|---|---|
| Who destroyed it | The company’s legal name and the address where the destruction took place | Ties the event to a real place you could visit or name in a policy |
| Whose material | Your business or household name as it appears in your records | Shows the certificate belongs to your job, not someone else’s |
| When | The date the material was destroyed, not only the date it was picked up | Starts the clock for your retention log and closes the custody gap |
| What | A description of the material: paper records, or media such as drives | Lets you match the certificate to the boxes on your log |
| How much | A weight, a box count or both | Shows the whole job was destroyed, not part of it |
| How | The method, for example cross-cut shredding for paper or physical destruction for media | Shows the method meets the standard your rules set |
| Who signed | A signature from the company, and yours if you witnessed it | Makes it a statement someone stands behind |
Two extras help on larger jobs. A job or reference number lets you match the certificate to an invoice and a booking. A short note of which date range of records went out, kept on your own log, lets you answer the question “were the 2018 charts destroyed?” without opening a single box.
What our certificate covers
Here is what we can state plainly about the certificate you get from New Hampshire Document Shredding. Every job gets one: drop-off, pickup and witnessed. It is covered by the $14.95 HIPAA filing fee, which is part of the $34.90 per-job fees on every job, so there is no separate charge for it.
Where and how
All paper is cross-cut shredded at one place, our office at 1215 Main Street, Unit 115, Tewksbury, MA. Drop-off paper is shredded the same business day. Pickup material is shredded after it arrives at the office. All of the shredded paper is recycled.
Witnessed sessions
If you book a witnessed shredding session, you watch your material go through the shredder and the certificate is signed in front of you. It costs $1.99 per pound with a $100 minimum, plus $34.90.
Media such as hard drives, phones and USB sticks is physically destroyed and quoted per item. Bag it separately when you book. If your auditor or compliance officer needs a particular item to appear on the certificate, tell us when you book or call (978) 636-0301, and we will tell you before the job whether ours covers it.
Who should insist on a certificate
Every customer gets one, but some customers truly depend on it. The more people outside your household or office who could ask about the records, the more the certificate is worth.
Businesses with a legal duty
Medical, dental and therapy practices holding patient records. Tax preparers, bookkeepers and lenders holding customer financial information. Landlords, car dealers and employers who pull consumer reports. Law offices closing out client files. For all of them, the certificate is the piece of paper that shows a records policy was actually followed, not just written down.
People acting for someone else
Executors, trustees and family members with a power of attorney are handling records that belong to another person. A certificate shows the family, the court or the next trustee what happened to the bank statements and tax years that were cleared out. It turns “we got rid of it” into a dated, signed record.
Households clearing their own paper rarely need the certificate for anything formal. It still costs nothing extra, and it makes a tidy record in the tax folder of which years are gone. Our residential shredding page covers household jobs from start to finish.
The rules that make a certificate worth having
No single law says “you must obtain a certificate of destruction.” Several rules, though, ask you to dispose of records properly and to be able to show it. The certificate is the simplest way to meet that second part.
HIPAA
45 CFR 164.530(c) requires safeguards for patient information, and 164.530(j) requires covered entities to keep a written or electronic record of actions the rules require to be documented, for six years. Our HIPAA shredding requirements post covers the details.
FTC Disposal Rule
16 CFR 682.3 requires reasonable disposal of consumer report information. One example is hiring a destruction company after due diligence and “monitoring compliance” with the contract. A certificate per job is how most businesses monitor. See our post on the FACTA disposal rule.
GLBA Safeguards Rule
16 CFR 314.4(c)(6) requires secure disposal of customer information, generally no later than two years after it was last used, and 314.4(f) requires periodic checks on service providers. Tax preparers and other financial firms fall under it.
For practices, a Business Associate Agreement sits next to the certificate. We sign one on request. Our medical shredding service page explains how the two fit together for a New Hampshire office.
How long to keep a certificate of destruction
A certificate proves something about other records, so its life should match theirs. The safe rule is to keep it at least as long as anyone could ask about the records it covers. For most New Hampshire offices that means six years at a minimum, and many simply keep a scanned copy for good.
| If the certificate covers | Rule that sets the clock | Keep the certificate at least |
|---|---|---|
| Patient records or other PHI | 45 CFR 164.530(j)(2): six years from creation or the date last in effect | 6 years |
| Client tax files at a tax preparer | 16 CFR 314.4(c)(6): disposal within two years of last use, unless a rule requires longer. IRS periods of 3, 4, 6 or 7 years for the underlying records | As long as the longest period that could apply, and 6 years is a sensible floor |
| Payroll and employment tax records | IRS: at least 4 years after the tax is due or paid | 4 years after the last record destroyed, or longer under your policy |
| Household tax records | IRS: generally 3 years, 6 or 7 in some cases | Optional, but cheap to keep with your tax files |
| An estate’s papers | The estate’s own closing timeline | Until the estate is fully closed, then with the estate file |
One practical point: the clock for the certificate starts when the records are destroyed, not when they were created. A 2026 certificate for 2018 records starts a new six-year run in 2026. Our document retention guide covers the record periods themselves, and our tax records retention guide lists the IRS rules year by year.
How to file certificates so you can find them
A certificate in a desk drawer is almost as bad as none. The goal is to answer any question about destroyed records in two minutes, years from now, without relying on the memory of someone who has since left.
- Log before you boxWrite down the date range and type of records going into each box, and the number of boxes. Keep the log with your records policy.
- Match the certificate to the logWhen the certificate arrives, staple or link it to that log entry. Check the date, the description and the quantity.
- Scan it the same daySave a PDF in a folder your privacy or compliance officer controls, named by date. Keep the paper original too.
- File it with the policyPut the original in the same binder as your records retention and destruction policy, and your BAA if you have one.
- Review once a yearAt your annual purge, confirm last year’s certificates are filed and that nothing older than your retention period is still sitting in storage.
If your office does not yet have a written destruction policy, our page on writing a records destruction policy gives you a structure to start from.
Red flags in a weak certificate
Most problems with certificates are not fraud. They are vague paperwork that will not hold up when someone actually reads it. Watch for these.
- No date of destruction, or only a pickup date.
- A description that says “shredding service” and nothing about what was destroyed.
- No weight or box count, so you cannot tell if the whole job was covered.
- No company address, or an address that is not where the shredding took place.
- No signature, or a certificate that arrives before the material could have been destroyed.
- A certificate that costs extra or is only issued if you ask for it.
If you are comparing companies, these are worth raising before you book. Our list of questions to ask a shredding company includes the certificate questions in plain words.
Households rarely need a certificate for legal reasons, but executors and trustees often do. If you are clearing out a parent’s papers, the certificate shows the family and the probate file what happened to the financial records. Our post on shredding after a death covers what to keep first.
Frequently asked questions
What is a certificate of destruction?
It is the shredding company’s written record that your material was destroyed. A useful certificate names the company and the customer, gives the date of destruction, describes what was destroyed and how much, states the method and carries a signature. It is the document you show an auditor, client or insurer who asks what happened to a set of records.
Does HIPAA require a certificate of destruction?
HIPAA does not name the certificate. It requires safeguards for patient information under 45 CFR 164.530(c) and requires covered entities to keep documentation of required actions for six years under 164.530(j). A certificate for each shredding job is the simplest way to document disposal, so most practices treat it as essential and file it with their HIPAA policies.
How long should I keep a certificate of destruction?
Keep it at least as long as anyone could ask about the records it covers. For HIPAA documentation the period is six years from creation under 45 CFR 164.530(j)(2). For tax-related records, match the IRS period of 3, 4, 6 or 7 years. Many offices keep scanned certificates permanently because storage costs almost nothing.
Do you charge extra for the certificate?
No separate charge. Every job, whether drop-off, pickup or witnessed, includes a Certificate of Destruction, covered by the $14.95 HIPAA filing fee. That fee is part of the $34.90 in per-job fees along with the $19.95 environmental fee for recycling. One box at drop-off costs $64.60 in total, certificate included.
Does a certificate of destruction need to be notarized?
None of the federal rules discussed here, HIPAA, the FTC Disposal Rule or the GLBA Safeguards Rule, mentions notarizing a certificate. What they care about is proper disposal you can document. If an auditor, court or agency has asked you for a notarized document, tell us when you book or call (978) 636-0301, and we will tell you before the job what we can provide.
Can I watch my documents being destroyed?
Yes. Book a witnessed session and you watch your material go through the shredder at our Tewksbury office. The certificate is signed in front of you. Witnessed shredding costs $1.99 per pound with a $100 minimum on the shredding charge, plus the $34.90 per-job fees. Sessions are by appointment.
Do I get a certificate for hard drives too?
Media such as hard drives, phones, tapes and USB sticks is physically destroyed and quoted per item. Bag media separately from your paper and list it when you book, so it is priced and handled before the job. Ask at booking how the media will appear on your certificate if you need it itemized for an audit.
What if I lose a certificate?
Call us with the date of the job and the name it was booked under, and ask whether a copy can be provided. Then fix the filing so it does not happen again: scan every certificate the day it arrives, name the file by date and keep the original in the binder with your records policy.
Sources
- 45 CFR 164.530, HIPAA administrative requirements, (c) safeguards and (j) documentation and retention (govinfo.gov) (checked November 2026)
- 16 CFR 682.3, FTC Disposal Rule, proper disposal of consumer information (govinfo.gov) (checked November 2026)
- 16 CFR 314.4, GLBA Safeguards Rule, (c)(6) disposal and (f) service providers (govinfo.gov) (checked November 2026)
- IRS: How long should I keep records (checked November 2026)
Get a certificate with every box
Drop off on any weekday, book a pickup by zone or watch your records shredded at a witnessed session. Every job ends with a Certificate of Destruction for your files, at no separate charge.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Pickups and witnessed sessions outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.